Why You Must Kill Your Certificate Authority

You can migrate every user to the cloud and retire every workload, and Active Directory still won't go away — because two systems, your certificate authority and Exchange Hybrid, are quietly holding the domain controller hostage. 🔐 In this episode, Ernie and Josée trace exactly how a low-privilege foothold — a phished user, an exposed ethernet jack — escalates into full domain compromise using nothing but native Windows features: coercing a domain controller into an NTLM handshake, relaying it to the certificate authority's web enrollment endpoint, and walking away with a certificate that mints a valid Ticket Granting Ticket. No custom exploit required. 🕵️ We map the invisible web of trust holding that certificate authority in place — 802.1X Wi-Fi, VPN client authentication, smart card login, internal TLS — and why a hard shutdown doesn't produce a clean failure, it produces weeks of cascading outages that look nothing like a certificate problem. 🌐 We debunk the "cloud mirage" assumption that Entra ID or Microsoft Cloud PKE can simply replace it, walk through the third-party platforms that actually bridge the gap, and cover the physical hardware problem post-quantum certificate sizes create for legacy network buffers. ⚛️ Then we turn to Exchange Hybrid's zombie server trap — a fully patched, fully vulnerable on-prem server whose only remaining job is editing text fields in a database — and the exact sequence that finally lets you retire it. 📧 You'll leave knowing exactly why these two systems block full Active Directory removal, and the precise migration sequence that finally lets you shut the domain controller down for good. If you're the one deciding when Active Directory can finally be retired, this episode is not optional. ✅ Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott